Overview

overview

10

Static

static

10a8e2efb4...0a.exe

windows7_x64

10

10a8e2efb4...0a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10a8e2efb42996436bf795292f879262f9b3b8af0e1ca529c71f37c027f2b20a

  • Size

    36KB

  • Sample

    220212-gxjkssaeal

  • MD5

    fa7484f2b3b8e299c7d347ff1beb318d

  • SHA1

    302f5bff981cf592fee7454132176ed44e224072

  • SHA256

    10a8e2efb42996436bf795292f879262f9b3b8af0e1ca529c71f37c027f2b20a

  • SHA512

    7eefc03b6505005894eef81541fcbb1cf2a67b0fd054d2f38af996b0c8aca15cf09e3a2e2d8c805e190c28dde9d825aeedf76057c8c351f48b37601c65923203

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10a8e2efb42996436bf795292f879262f9b3b8af0e1ca529c71f37c027f2b20a

    • Size

      36KB

    • MD5

      fa7484f2b3b8e299c7d347ff1beb318d

    • SHA1

      302f5bff981cf592fee7454132176ed44e224072

    • SHA256

      10a8e2efb42996436bf795292f879262f9b3b8af0e1ca529c71f37c027f2b20a

    • SHA512

      7eefc03b6505005894eef81541fcbb1cf2a67b0fd054d2f38af996b0c8aca15cf09e3a2e2d8c805e190c28dde9d825aeedf76057c8c351f48b37601c65923203

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks